CVE-2024-4990: Unsafe Reflection in base Component class in yiisoft/yii2
Summary
CVE-2024-4990: Unsafe Reflection in base Component class in yiisoft/yii2. Affects yiisoft/yii2 versions < 2.0.49.4. Fixed in 2.0.49.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The yiisoft/yii2 package is a popular open-source PHP framework used for developing web applications. It provides a set of components and tools that simplify the development process. One of the key features of Yii2 is the ability to attach behaviors to components, which enhances their functionality. However, a vulnerability has been identified in the base Component class of Yii2, which allows for unsafe reflection and potential code execution.
Vulnerability Detail
The vulnerability in Yii2 arises from the lack of validation checks when setting properties in the Component class. When attaching behaviors to components, the __set() magic method is used. If the value passed to this method is not an instance of the Behavior class, a new object is instantiated using Yii::createObject($value). However, there is no validation to ensure that $value is a valid Behavior class name or configuration. This allows an attacker to control the content of $value and instantiate arbitrary classes, passing parameters to their constructors and invoking setter methods. This can lead to various types of attacks, including file deletion and database table dropping.
How To Fix
Minimum fixed version
2.0.49.4
This is the first release that contains the fix.
composer require yiisoft/yii2:2.0.49.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is currently no known workaround for this vulnerability.
Conclusion
The unsafe reflection vulnerability in the base Component class of Yii2 can lead to potential code execution and various types of attacks. It is important to stay updated on security patches and fixes released by the Yii2 project. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for yiisoft/yii2 →
FAQ
Yii2 is an open-source PHP framework used for developing web applications. It provides a set of components and tools that simplify the development process.
The impact of this vulnerability can vary depending on the target application. It could range from retrieving sensitive information to denial of service or unauthorized access.
No, there is currently no fix available for this vulnerability. It is recommended to monitor for updates from the Yii2 project and apply any security patches as soon as they are released.
No, there are currently no known workarounds for this vulnerability.
If you have discovered this vulnerability, you can report it to the Yii2 project or the security team responsible for the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for yiisoft/yii2.
